What are GCP Workload Identity Federation and AWS IAM Roles for Service Accounts (IRSA)?

To federate **AWS IAM Identity Center** (AWS SSO) with **Okta** or **Azure AD**, follow this setup: ### 1. SAML 2.0 Federation 1. In AWS IAM Identity Center Console, go to **Settings** → **Identity source** → **Change identity source** and select **External identity provider**. 2. Download the AWS SAML Metadata file and copy the ACS URL. 3. In Okta or Azure AD, create a new Enterprise Application for AWS IAM Identity Center, upload the AWS metadata XML, and map `user.email` as `Subject NameID`. ### 2. Automatic SCIM 2.0 Provisioning Enable automatic provisioning in AWS IAM Identity Center to generate a SCIM endpoint and Access Token. Enter these into Okta so users and groups sync automatically. You can verify SCIM connectivity with curl: ```bash curl -X GET "https://scim.us-east-1.amazonaws.com/v2/Users" \ -H "Authorization: Bearer YOUR_SCIM_ACCESS_TOKEN" \ -H "Accept: application/scim+json" ``` ### 3. Permission Set Mapping In IAM Identity Center, map Okta groups to AWS account permission sets: - `DevOps-Lead` → Production Account → `AdministratorAccess` - `Backend-Engineers` → Staging Account → `PowerUserAccess` Developers can then log in securely via CLI: ```bash aws configure sso aws sso login --profile staging-backend ``` **Gotcha to watch for**: Set CLI session limits to 4-8 hours so developers don't have to re-authenticate constantly, while preventing unexpiring access tokens.